Every new Laravel project starts with a simple idea.
Build a SaaS app. Create a CRM. Launch a client portal.
Then the requirements arrive:
- Admins can manage everything.
- Managers can manage some things.
- Editors can edit content but cannot delete users.
- Regular users should only access their own features.
Suddenly, your weekend project needs a role management system, a permissions catalog, protected routes, user administration, and authorization tests.
Congratulations. You are building an administration framework before building your actual product.
I've been there. So I built something to make that setup less repetitive.
The problem isn't authentication. It's everything around it.
Laravel provides excellent authentication and authorization tools. Spatie Laravel Permission makes managing roles and permissions much easier.
But integrating the pieces into a usable application still takes work.
You need to connect permissions to roles, build an interface to manage them, protect sensitive actions, and verify that unauthorized users cannot bypass the UI by calling an endpoint directly.
That last part is important.
Hiding a button is not access control.
If a user cannot see the Delete button but can still submit a request to the deletion endpoint, your authorization implementation has a problem.
The server must enforce the rules.
What I built
I created Laravel Roles & Permissions Starter, a reusable foundation for Laravel applications that need role-based access control and an admin panel.
The stack includes:
- Laravel 12 and PHP 8.2+
- Spatie Laravel Permission 8
- Laravel Breeze
- Blade, Tailwind CSS, and Alpine.js
- Vite and PHPUnit
- DDEV configuration for local development
Here's what is included.
1. Five predefined roles
The starter includes:
- Super Admin
- Admin
- Manager
- Editor
- User
It uses permission keys such as users.view, roles.delete, and permissions.manage.
You can create, edit, and duplicate roles, assign permissions, and manage users with multiple roles. Protected-role safeguards help prevent accidental deletion of important roles.
2. Server-side authorization
The application uses Laravel Gates and Policies to protect administrative functionality.
Super Admin bypass logic is centralized, and protected roles and accounts have additional safeguards.
The sidebar also adapts to the current user's permissions, but the backend remains responsible for enforcing access.
3. User administration
Manage registered users, assign roles, change account status, and delete users with confirmation.
These are useful building blocks for SaaS applications, internal tools, CRMs, and business dashboards.
4. Audit logging
Role, user, and permission changes are recorded with details such as the actor, action, subject, metadata, IP address, and user agent.
Recent activity appears on the dashboard, and the underlying records can be queried from the database.
A dedicated audit-log browsing interface is not included in this release.
5. A dashboard with real database data
The dashboard displays counts for users, roles, permissions, and audit events, alongside an access overview and recent activity.
No hardcoded dashboard numbers pretending to be production analytics.
6. Thirty-three automated tests
The starter includes 33 tests covering authentication, profile management, and role-based access control.
Examples include guest restrictions, authorization failures, role assignments, permission persistence, and default-role assignment during registration.
Run them with:
composer test
Tests are not a guarantee that every future customization will be secure, but they give you a useful baseline for ongoing development.
Try the demo before looking at the code
I prefer showing developers what they're getting rather than asking them to trust a sales page.
Live demo: https://laravelrolesstarter.vercel.app/
Explore the interface and see whether it fits your next project.
Get the source code: https://boukataya.gumroad.com/l/xqmkag
The package includes the application source code, migrations, seeders, factories, tests, setup instructions, and DDEV configuration.
What it doesn't include
To keep expectations clear, this release does not include REST API endpoints, a dedicated audit-log browser, an administration settings screen, or Docker Compose configuration.
It focuses on the existing Laravel web application and its authentication, RBAC, user management, dashboard, and audit-logging functionality.
You can extend it to fit your own architecture and requirements.
When is this useful?
Consider it if you're building a SaaS application, CRM, client portal, e-commerce back office, or internal business tool and don't want to assemble the same administration foundation from scratch.
The goal isn't to eliminate development. It's to reduce repetitive setup so you can focus on the features that make your application different.
Demo: https://laravelrolesstarter.vercel.app/
Product: https://boukataya.gumroad.com/l/xqmkag
What part of a new Laravel project do you find yourself rebuilding most often: authentication, authorization, user management, or something else?
Top comments (0)